CVE-2026-77104

Analyzed Analyzed - Analysis Complete

Path Traversal in CommServe Information Disclosure

Publication date: 2026-09-08

Last updated on: 2026-09-09

Assigner: Commvault

Description

CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-77104

Affected Vendors & Products

Vendor	Product	Version / Range
commvault	commvault	From 11.36.0 (inc) to 11.36.123 (exc)
commvault	commvault	From 11.40.0 (inc) to 11.40.72 (exc)
commvault	commvault	From 11.44.0 (inc) to 11.44.20 (exc)
commvault	commvault	From 11.46.0 (inc) to 11.46.20 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CommServe had a path traversal issue that allowed unauthorized access to sensitive information. This flaw could let attackers read files outside intended directories by manipulating file paths.

Impact Analysis

Attackers could exploit this to access confidential data, including backups or system files, leading to data breaches or further network compromise. Users should upgrade to the fixed version immediately.

Compliance Impact

This vulnerability could result in unauthorized data exposure, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face fines or penalties for non-compliance due to insufficient data safeguards.

Mitigation Strategies

Upgrade CommServe to the resolved maintenance release as soon as possible to address the path traversal issue affecting information disclosure.

Hi! I’m here to help you understand CVE-2026-77104. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70